Send an e-mail when an interface goes down « blog (2024)

Send an e-mail when an interface goes down

John S. Pumphrey recently asked an interesting question: “Can the router send an e-mail when an interface goes down?” The enterprisey solution is obvious: deploy a high-end EMS to collect SNMP traps and use its API to write a custom module that would use a MQ interface to alert the operator. Fortunately, Event Manager applets in Cisco IOS provide action mail command (available in 12.3(14)T and 12.4) that can send an e-mail to a SMTP server straight from the router.

There are two ways you can detect that an interface went down with EEM: either you track the interface status with a track object and start an EEM applet when the track object changes state or you catch the syslog messages reporting that the interface line protocol changed state to down. The second approach is obviously more generic, as a single applet can act on multiple interfaces.

event manager applet MailOnIfDown
event syslog occurs 1 →
pattern "LINEPROTO-5-UPDOWN.*to down" →
period 1


  • If you want to limit the applet to serial interfaces only, you could change the pattern to LINEPROTO-5-UPDOWN.*Serial.*to down.
  • The → continuation character is used to indicate that a single configuration line has been split to increase readability.

The action mail command specifies the mail server's address (use a hostname and DNS lookup or ip host configuration command to make the EEM applet more generic), from and to address, message subject and body. In each of these fields, you can use EEM environment variables that you can define with the event manager environment configuration command. Each EEM event also defines a few environment variables that you can use (see the table of EEM system-defined variables on CCO). For example, you can define the e-mail recipient in the router's configuration and use the _syslog_msg variable to include the syslog message in the e-mail body:

event manager environment _ifDown_rcpt [emailprotected]
event manager applet MailOnIfDown
event syslog occurs 1 →
pattern "LINEPROTO-5-UPDOWN.*to down" →
period 1
action 1.0 mail server "mail-gw" →
to "$_ifDown_rcpt" from "[emailprotected]" →
subject "Interface down on R1" →
body "$_syslog_msg"

You can make the applet even more generic with the help of action info type routername command, which stores the current router's name into the $_info_routername environment variable:

event manager environment _ifDown_rcpt [emailprotected]
event manager applet MailOnIfDown
event syslog occurs 1 →
pattern "LINEPROTO-5-UPDOWN.*to down" →
period 1
action 1.0 info type routername
action 2.0 mail server "mail-gw" →
to "$_ifDown_rcpt

" from "$" →
subject "Interface down on $_info_routername" →
body "$_syslog_msg"

Note: This article is part of You've asked for it series.

  • network management
  • EEM

Recent posts in the same categories

network management

  • Worth Exploring: Akvorado Flow Collector and Visualizer
  • Worth Reading: Splitting the Ping
  • Streaming Telemetry with Avi Freedman on Software Gone Wild
  • SuzieQ with Dinesh Dutt and Justin Pietsch on Software Gone Wild
  • Interesting: Measuring End-to-End Latency in Web Browser
  • What If... There Would Be an Easy Way to Run Your Network


  • Changing configuration with EEM – yes or no?
  • Shut Down BGP Session Based on Tracked Object
  • Monitor multiple interfaces with a single EEM applet
  • Router reload after 15 minutes of failed pings
  • EEM QA: what were they (not) doing?
  • Stop accidental scheduled router reloads


  1. Anonymous 03 December 2007 18:11

    Watch out for: (12.4.15T1)

    CSCsl53037: Mail action does not separate headers from body

    Symptom: Emails originating from Embedded Event Manager (EEM) applets do not have proper subject and body components. Instead, the body is appended to the end of the Subject: line, and the actual body of the message is empty.

    Conditions: This occurs when sending email from EEM applets.

    Workaround: Using an EEM TCL policy instead offers more flexibility when sending email. See for more on writing EEM policies using TCL.

  2. BB Blog 17 October 2012 10:07

    please sombody help me for this , its really urgent ,
    we need the same thing like this topic but we need to send to gmail . i really give up since its always show me cannot connect to server . is there anybody that can help or configured this before to use with gmail ?


    1. Ivan Pepelnjak 17 October 2012 12:54

      If you would have read this: you'd discovered Gmail requires SSL/TLS encryption on SMTP sessions, which is not supported by Cisco IOS.

      Register a domain (costs a few $$$ per year) with someone that supports email forwarding.

Newer Post


Older Post
Send an e-mail when an interface goes down « blog (2024)


Top Articles
Latest Posts
Article information

Author: Dean Jakubowski Ret

Last Updated:

Views: 5605

Rating: 5 / 5 (70 voted)

Reviews: 93% of readers found this page helpful

Author information

Name: Dean Jakubowski Ret

Birthday: 1996-05-10

Address: Apt. 425 4346 Santiago Islands, Shariside, AK 38830-1874

Phone: +96313309894162

Job: Legacy Sales Designer

Hobby: Baseball, Wood carving, Candle making, Jigsaw puzzles, Lacemaking, Parkour, Drawing

Introduction: My name is Dean Jakubowski Ret, I am a enthusiastic, friendly, homely, handsome, zealous, brainy, elegant person who loves writing and wants to share my knowledge and understanding with you.